1. Field
The present disclosure relates generally to systems and methods for information security management by detecting and responding to threats to data processing environments that may include a number of data processing systems connected to a network. More particularly, the present disclosure relates to identifying a data processing system that is the target of a threat to a data processing environment and responding to the threat in a manner that reduces disruption to the data processing environment.
2. Background
A variety of commercial, governmental, and other entities may perform numerous functions in a data processing environment. The data processing environment may include a number of data processing systems. For example, a data processing environment may include a host data processing system and a number of guest data processing systems associated with the host data processing system. The data processing environment may be configured to receive network traffic from a variety of sources via a network connection. Received network traffic may be directed by the host data processing system to the number of guest data processing systems as appropriate.
A data processing environment connected to a network may be subject to a number of threats. For example, such a threat may include an attempt to affect the performance of the data processing environment in undesired ways. A threat against a data processing system in the data processing environment may be recognized by detecting an anomaly in the network traffic directed to the data processing system.
Information security management is a common problem faced by various economic sectors employing network-centric operations where a safety-first principal is central. An air traffic control system is an example of such a system including a data processing environment that may be subject to a number of threats. Information systems for air traffic control may include networked ground systems and satellite systems, air-to-ground, air-to-satellite and air-to-air interfaces, and stakeholder organizations and authorized personnel and processes.
A fundamental difference between safety and information security management in air traffic control systems is that existing safety guidelines may not consider malicious activities that may emerge with the use of computer network capabilities in the national airspace system. Safety and information security management, however, may have commonalities in consequences of dangers and incidents in the air traffic control systems. Therefore, a safety management system framework may be applicable to information security management. However, a safety management system framework also may have major gaps with respect to information security management. Processes and approaches that can potentially bridge these gaps are desirable. Considerations for assessing information security risks from any changes to the national airspace system and defining information security controls for risk mitigation also are desirable.
A safety management system may cover safety hazards and not the cause of these hazards. Hence, if a malicious activity causes a safety hazard, the impact such as danger, incident, or harm to the asset of the malicious activity may be covered by the safety management system. It is desirable, however, that an information security management system is configured to assess and evaluate the likelihood of this malicious activity, other potential consequences of this malicious activity that may not be covered by the safety management system, design security assurance functions that lower the likelihood, and promote the security assurance functions.
Information security measures are desirable for air traffic control systems to ensure that no hazard or incident can be introduced through intended system operation, unanticipated errors in applications, unexpected environmental conditions, or deliberate malicious attack. Additionally, security measures may be desirable to ensure that organizations involved in developing, operating, and servicing the air traffic control system and supporting the air traffic control mission of efficiently, safely, and securely managing air traffic in the national airspace system, may operate their businesses effectively and in fulfillment of legal requirements and business objectives.
It is desirable to respond to the detection of a threat against a data processing environment in a manner that protects the data processing environment, including the data being processed in the data processing environment, from the potential threat. However, responding to a detected threat may itself disrupt operation of the data processing environment.
Accordingly, it would be beneficial to have a method and apparatus that takes into account one or more of the issues discussed above as well as possibly other issues.